about summary refs log tree commit diff
path: root/users/tazjin/nixos/camden
diff options
context:
space:
mode:
authorVincent Ambo <tazjin@google.com>2020-10-04T11·30+0000
committertazjin <mail@tazj.in>2020-10-04T15·51+0000
commit2670f84f5f34699776ff51a2afb1b737737cedaa (patch)
treebe926de165feaeb415924c112656679b8e3a7fe6 /users/tazjin/nixos/camden
parent3fc1143a04da49a92c3663813c6a0c1e8ccd477f (diff)
fix(tazjin/camden): Backport 19.09 ACME module r/1832
The new one is causing breakage for me, but I have no time to debug
this, so I'm backporting the old one.

AFAICT the simp_le included in this channel should be new enough to
have ACMEv2 compat, we'll see if it works.

Change-Id: Ib8b869a5af8a0418a66017a0cf3b9336df5f2d05
Reviewed-on: https://cl.tvl.fyi/c/depot/+/2017
Tested-by: BuildkiteCI
Reviewed-by: tazjin <mail@tazj.in>
Reviewed-by: lukegb <lukegb@tvl.fyi>
Diffstat (limited to 'users/tazjin/nixos/camden')
-rw-r--r--users/tazjin/nixos/camden/default.nix27
1 files changed, 20 insertions, 7 deletions
diff --git a/users/tazjin/nixos/camden/default.nix b/users/tazjin/nixos/camden/default.nix
index f1cbffd305b1..aae1427f6745 100644
--- a/users/tazjin/nixos/camden/default.nix
+++ b/users/tazjin/nixos/camden/default.nix
@@ -14,13 +14,25 @@ config: let
     extraConfig = "return 301 https://${to}$request_uri;";
   };
 in lib.fix(self: {
-  imports = [
-    "${depot.depotPath}/ops/nixos/depot.nix"
-    "${depot.depotPath}/ops/nixos/quassel.nix"
-    "${depot.depotPath}/ops/nixos/smtprelay.nix"
-  ];
   depot = depot;
 
+  # Disable the current ACME module and use the old one from 19.09
+  # instead, until the various regressions have been sorted out.
+  # TODO(tazjin): Remove this once the new ACME module works.
+  disabledModules = [ "security/acme.nix" ];
+  imports =
+    let oldChannel = fetchTarball {
+      # NixOS 19.09 on 2020-10-04
+      url = "https://github.com/NixOS/nixpkgs-channels/archive/75f4ba05c63be3f147bcc2f7bd4ba1f029cedcb1.tar.gz";
+      sha256 = "157c64220lf825ll4c0cxsdwg7cxqdx4z559fdp7kpz0g6p8fhhr";
+    };
+    in [
+      "${depot.depotPath}/ops/nixos/depot.nix"
+      "${depot.depotPath}/ops/nixos/quassel.nix"
+      "${depot.depotPath}/ops/nixos/smtprelay.nix"
+      "${oldChannel}/nixos/modules/security/acme.nix"
+    ];
+
   # camden is intended to boot unattended, despite having an encrypted
   # root partition.
   #
@@ -186,10 +198,10 @@ in lib.fix(self: {
   # Provision a TLS certificate outside of nginx to avoid
   # nixpkgs#38144
   security.acme = {
-    acceptTerms = true;
-    email = "mail@tazj.in";
+    # acceptTerms = true;
 
     certs."tazj.in" = {
+      email = "mail@tazj.in";
       user = "nginx";
       group = "nginx";
       webroot = "/var/lib/acme/acme-challenge";
@@ -205,6 +217,7 @@ in lib.fix(self: {
     };
 
     certs."quassel.tazj.in" = {
+      email = "mail@tazj.in";
       webroot = "/var/lib/acme/challenge-quassel";
       user = "nginx"; # required because of a bug in the ACME module
       group = "quassel";